External risk intelligence

Google Chrome Use-After-Free in Views Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2026-79140

The vulnerability exists in Google Chrome, a widely deployed web browser. While it requires user interaction via a crafted HTML page, browsers are explicitly designed to render untrusted internet content, making the attack surface commonly reachable through normal web browsing activities.

Use After Free

Google Chrome

before 152.0.7977.65

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

A vulnerability in Google Chrome's rendering engine could allow attackers to execute code on user systems through malicious web pages. The issue is in a component responsible for displaying web content, and it has been classified as a critical security risk by CVSS scoring. The main concern is confirming relevance and exposure.

Bug in web rendering allows remote code execution.
Impacts users visiting malicious websites.
Verify if our systems use affected Chrome versions.

Attack Path

How an attacker could exploit the issue

A remote attacker could lure a user into visiting a malicious webpage, triggering a use-after-free vulnerability within Chrome's Views component. This could allow the attacker to execute arbitrary code with the user's privileges, potentially bypassing sandbox restrictions and gaining control outside of the browser's intended limitations.

Requires visiting a malicious webpage.
Vulnerability triggered by crafted HTML.
Risk of arbitrary code execution.

Live Threat

Current exploitation, exposure, and threat context

A use-after-free vulnerability in Chrome's Views component could allow a remote attacker to execute arbitrary code outside the browser's sandbox when a user visits a specially crafted HTML page. This could potentially impact the confidentiality, integrity, and availability of the user's system when supported by the advisory.

Arbitrary code execution outside sandbox.
Crafted HTML page via remote attacker.
System compromise or data exposure.

Operational Fix

Recommended remediation, mitigation, and detection steps

The presence of a use-after-free vulnerability in Google Chrome's Views component necessitates action from teams responsible for endpoint security and browser management. The first practical step is to identify all systems running the affected browser version, assess their exposure to the internet, and confirm if they are business-critical. Once identified, the accountable owner should be determined to plan remediation, which may involve coordinated vendor engagement and carefully scheduled updates.

Endpoint and browser management teams own this.
Verify user exposure to crafted HTML pages.
Plan vendor-coordinated updates for critical systems.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Google Chrome and the Views component mentioned in CVE-2026-79140?

Google Chrome is a widely used web browser that renders internet content for users. The Views component is a core part of its architecture responsible for managing and displaying the user interface and web elements. When you browse the web, this system handles the complex task of drawing visual components; CVE-2026-79140 involves a memory management error specifically within this rendering process on Mac systems.

What does use-after-free mean for this vulnerability?

A use-after-free, or CWE-416, happens when a program continues to use a piece of memory after it has been deleted or freed. In this case, an attacker provides specially crafted HTML that tricks Chrome into mismanaging this memory. Because the browser might mistakenly try to access that invalid memory location, an attacker could potentially inject and execute their own unauthorized code on your computer.

How does an attacker trigger CVE-2026-79140?

An attacker triggers this by luring a user to visit a malicious website containing the crafted HTML. It is important to note that simply having the browser installed does not trigger the bug; the vulnerability requires active user interaction, specifically navigating to a page designed to exploit this memory flaw. Automated background tasks or passive connections that do not involve rendering the malicious HTML do not trigger the vulnerability.

Why should I care about this vulnerability based on Halo Surface Signal?

Halo Surface Signal flags this as likely to impact users because Google Chrome is designed to render untrusted content from the internet. Since the browser's primary function is to visit potentially unknown websites, the attack surface is constantly exposed during normal browsing. Because this flaw allows code execution outside the browser's protective sandbox, it poses a significant risk to the integrity of the underlying system.

What steps should I take to address CVE-2026-79140?

Start by identifying all systems in your environment currently running Chrome versions prior to 152.0.7977.65 on Mac. Once you have an inventory, prioritize updates for systems that frequently access the internet or handle sensitive data. Coordinate with your IT or browser management teams to ensure these systems are patched promptly, as updating to the latest version provided by the vendor is the standard way to resolve this type of memory management issue.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.